4

Lately, I've noticed that UFW is inactive until I activate it manually.

I've run ufw enable multiple times, checked that ufw.service is active, but it still does not start on boot.

Output of systemctl list-unit-files | grep -i ufw

ufw.service                                enabled         enabled

Output of systemctl status ufw

     Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
     Active: active (exited) since Sat 2022-09-24 12:15:01 +03; 1min 26s ago
       Docs: man:ufw(8)
    Process: 388 ExecStart=/lib/ufw/ufw-init start quiet (code=exited, status=0/SUCCESS)
   Main PID: 388 (code=exited, status=0/SUCCESS)

Sep 24 12:15:01 alienus-server systemd[1]: Finished Uncomplicated firewall.
Warning: journal has been rotated since unit was started, output may be incomplete.

I've tried re-enabling ufw.service and it did not work:

Removed /etc/systemd/system/multi-user.target.wants/ufw.service.
Created symlink /etc/systemd/system/multi-user.target.wants/ufw.service → /lib/systemd/system/ufw.service.

Outputs of everything right after a boot:terminal footage

Additional info: After purging and reinstalling UFW, both with copying old configurations and manually reconfiguring, it is still not working as intended. And even though it was active when it booted, a couple of hours later it got deactivated again. So in order to keep it active, I've added a cronjob to reactivate it every 30 minutes.

Where else can I check for the reason that it does not start automatically? What is Warning: journal has been rotated since unit was started, output may be incomplete.?

Improve this question
7
  • 1
    systemctl enable ufw - have you tried this?
    – DankyNanky
    Sep 24, 2022 at 12:20
  • 1
    @DankyNanky yes, I've tried disabling and enabling, re-enabling. Systemd service starts correctly (I can't see any error due to journal rotation) but ufw is still inactive after every boot.
    – Emre Talha
    Sep 24, 2022 at 13:34
  • According to your output of "systemctl status ufw.service" it says active though?
    – petep
    Sep 24, 2022 at 17:35
  • 2
    @petep yes, even though the ufw.service is active, the ufw itself is inactive. that's the strange part, that i'm trying to solve
    – Emre Talha
    Sep 24, 2022 at 21:11
  • State active (exited) means that systemd has successfully run the set of commands but that it does not know there is a daemon to monitor. I suspect this to be the case for UFW service.
    – ognjen011
    Oct 14, 2022 at 22:19

2 Answers 2

Reset to default
-2

UFW daemon will start automatically even if you don't enable it. You should run ufw enable to enable it. The below screenshot shows the difference.

(As it's a complete rewrite, I think it's better to re-post instead of editing.)

enter image description here

Improve this answer
2
  • Yes, I know that it starts automatically with the service, but somehow ufw does not get activated with the service or something disables it right after it has been activated. My answer, the second UFW service and the cron job, does this automatically since the UFW should never be inactive on a public server. That is the problem I'm trying to solve.
    – Emre Talha
    Oct 15, 2022 at 8:39
  • Again, similar to your last answer, this does not contribute anything to the question. The answers you gave are already discussed. Both in the question and the comment section.
    – Emre Talha
    Oct 15, 2022 at 8:42
-2

As a mitigation until I can gather further info about this issue, I've created a systemd-service to manually enable ufw.

ufw2.service:

[Unit]
Description=Uncomplicated firewall 2
Documentation=man:ufw(8)
After=ufw.service

[Service]
ExecStart=/etc/ufw/ufw.sh

[Install]
WantedBy=multi-user.target

ufw.sh

#!/bin/bash

sleep 10
ufw enable

(10-second sleep is to be sure that the main ufw service has started and settled)

Addition: I've noticed that ufw got deactivated while the server was open for a couple of hours. So as a second mitigation, I've added a cron job to run it every 30 minutes.

*/30 * * * * systemctl restart ufw2
Improve this answer
2
  • The “exited” UFW is still working, so this answer does do nothing.
    – Emoji
    Oct 14, 2022 at 14:14
  • Without this additional enabling of UFW, the firewall is still inactive after a boot. In my case, this is the systemd-service that actually activates the firewall. So, this answer does do someting
    – Emre Talha
    Oct 14, 2022 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.